CVE-2012-5491
Plone Information Disclosure
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
Exploit likelihood
What each source reports
NVD Score used
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
- Record
CVE-2012-5491- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
- Record
CVE-2012-5491- Updated
- 2026-11-02
EUVDEUVD-2014-0051 No score
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
- Record
EUVD-2014-0051- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f8pg-wp5j-rjxx
Plone Information Disclosure
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
- Record
GHSA-f8pg-wp5j-rjxx- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-f8pg-wp5j-rjxx
Plone Information Disclosure
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
- Record
GHSA-f8pg-wp5j-rjxx- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVPYSEC-2014-33 No score
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
- Record
PYSEC-2014-33- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plonePyPI |
before 4.2.3 | 4.2.3 |
plonePyPI |
4.3a0 up to 4.3b1 | 4.3b1 |
plonePyPI |
before 4.2.3, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2 |
4.2.3 |
plonePyPI |
4.3a0 up to 4.3b1, plus listed versions 4.3a14.3a2 |
4.3b1 |
plonePyPI |
before 4.2.3, 4.3a0 up to 4.3b1, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2 |
4.2.34.3b1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-5491 is a medium vulnerability (CVSS 4.3) in Plone, published September 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in plone 4.2.3.
References
github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
openwall.com/lists/oss-security/2012/11/10/1
plone.org/products/plone/security/advisories/20121106/07
nvd.nist.gov/vuln/detail/CVE-2012-5491
Left out here: 30 versions. The JSON record has them.